Researchers identify more than 3400 servers hit by PoeLLM mining malware

Lumen Black Lotus Labs identified more than 3400 victim servers in a cryptocurrency-mining campaign targeting exposed AI services and other enterprise systems, The Hacker News reported. The campaign, active since April 2026, installs miners and reuses compromised hosts to scan for and exploit additional victims. The PoeLLM malware derives its command-server address from changing words in a poem hosted on GitHub. Targets include LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances, with infections concentrated in the US and Western Europe. Recent traffic suggests experiments with distributed password guessing, whose maturity remains uncertain.